What action is required when media is moved from a secured area?

• A. The media may be moved with no authorization if it is internal.
• B. Proper management authorization is obtained whenever media is moved from a secured area (including when distributed to individuals).
• C. Authorization is required only for off-site shipments.
• D. Only IT approval is required for moving media.

Answer: (B)

When media is moved from a secured area, proper management authorization is required for any movement, including when the media is distributed to individuals. This provides accountability, creates a documented trail (chain of custody), and helps prevent unauthorized access, loss, or disclosure of cardholder data. Movement within the organization—even to internal recipients—poses risk unless it is authorized and properly controlled. The other options loosen or narrow the requirement, allowing movement without management oversight or limiting authorization to off-site shipments or IT approval only, which does not align with safe handling of media containing sensitive data.